Delete by query on alias or multiple indexes

Elastic Stack Elasticsearch
1

I am trying to delete documents by query on multiple indexes.

The plugin seems to fail on aliases with the following error :
Alias [xxx] has more than one indices associated with it

I also tried to delete using _all and wildcard but it also fail.

Is there any way to delete documents by query on multiple indexes ?

2

Hi,

this works fine indeed. Here's a complete example based on Elasticsearch 2.2:

Install the delete-by-query plugin:

bin/plugin install delete-by-query

Create a few documents in multiple indices:

POST /_bulk
{"index":{"_index":"logs-2014","_type":"click"}}
{"ip_address":"1.1.1.1","event":"click"}
{"index":{"_index":"logs-2014","_type":"click"}}
{"ip_address":"1.1.1.1","event":"buy"}
{"index":{"_index":"logs-2015","_type":"click"}}
{"ip_address":"1.1.1.1","event":"click"}
{"index":{"_index":"logs-2015","_type":"click"}}
{"ip_address":"1.1.1.1","event":"buy"}
{"index":{"_index":"logs-2016","_type":"click"}}
{"ip_address":"1.1.1.1","event":"click"}
{"index":{"_index":"logs-2016","_type":"click"}}
{"ip_address":"1.1.1.1","event":"buy"}
{"index":{"_index":"logs-2016","_type":"click"}}
{"ip_address":"1.1.1.1","event":"click"}

Add a logs alias for all these indices:

POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "logs-2014", "alias" : "logs" } },
        { "add" : { "index" : "logs-2015", "alias" : "logs" } },
        { "add" : { "index" : "logs-2016", "alias" : "logs" } }
    ]
}

Check that we actually have documents across multiple indices:

GET /logs/_search
{
   "query": {
      "match_all": { }
   }
}

Now delete all "click" events across all indices (based on the alias logs):

DELETE /logs/_query
{
   "query": {
      "match": {
         "event": {
            "query": "click"
         }
      }
   }
}

This returns:

{
   "took": 0,
   "timed_out": false,
   "_indices": {
      "_all": {
         "found": 4,
         "deleted": 4,
         "missing": 0,
         "failed": 0
      },
      "logs-2015": {
         "found": 1,
         "deleted": 1,
         "missing": 0,
         "failed": 0
      },
      "logs-2016": {
         "found": 2,
         "deleted": 2,
         "missing": 0,
         "failed": 0
      },
      "logs-2014": {
         "found": 1,
         "deleted": 1,
         "missing": 0,
         "failed": 0
      }
   },
   "failures": []
}

Daniel

3

You're right, it works fine !

I made a mistake in uris.
I was using this one for check : GET /logs/_search
And quite the same for delete : DELETE /logs/_search

But for delete it is query and not search as you suggested : DELETE/logs/_query

Thanks for your help.

4

You're right. It is "query". I had already edited the post after I have initially written it. It should now be correct as is. Great to know that it works for you know.